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IN THE CLAIMS 

Amended claims follow: 

1 . (currently amended) A computer program product comprising a computer 
program operable to control a computer to generate audit data indicative of a request to 
execute a computer program, said computer program comprising: 

(i) computer virus scanner logic, responsive to a computer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for 
performing a computer virus scan and for generating a scan result; 

(ii) audit data generator lofri c separate from said computer virus scanner logic 
and being triggered by said computer virus scanner Inflic prior to said generating said scan 
result, and responsive to said data identifying said computer file to be scannedjhatjs 
received from said computer virus scanner logic for simultaneously perfo rming additional 
operations in parallel with said computer virus scan, said additional operations including 

[[. for ]] identifying a request to execute a computer progra m associated with said computer 
file to be scanned for computer viruses bv said computer virus scanner logic and, in response 
to identification of said request to execute said computer program, [[ for]] generating 
audit data identifying said computer program; and 

(iii) concurrent usage logic for performing a concurrent usage check for 
identifying a request to execute a further computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer network; 

wherein said predetermined number varies with time. 
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2. (original) A computer program product as claimed in claim 1, wherein a file 
access request to an operating system triggers generation of said computer virus scan 
request. 

3. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to data identifying one or more banned computer 
programs to identify a request to execute a banned computer program. 

4. (original) A computer program product as claimed in claim 3, wherein, if a 
request to execute a banned computer program is identified, then one or more banned 
program actions are triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

5. (original) A computer program product as claimed in claim 3, wherein said data 
identifying one or more banned computer programs is a permitted computer program list 
with any computer program not included within said permitted computer program list 
being a banned computer program. 

6. (cancelled) 
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7. (previously presented) A computer program product as claimed in claim 1, 
wherein, if said concurrent usage check indicates that said request to execute said further 
computer program would result in more than said predetermined number of computers 
upon said computer network concurrently executing said computer program, then said 
request to execute said further computer program is denied. 

8. (previously presented) A computer program product as claimed in claim 7, 
wherein a user message is displayed when execution of said further computer program is 
prevented. 



9, (cancelled) 

10. (previously presented) A computer program product as claimed in claim 1, 
wherein at certain times said predetermined number is zero. 



1 1 . (original) A computer program product as claimed in claim 1 , wherein said 
audit data generator logic calculates a checksum value from said computer file, said 
checksum value being used in identification of said computer file as a particular 
computer program. 

12. (original) A computer program product as claimed in claim 11, wherein said 
audit data generator logic stores said calculated checksum value and uses said stored 
calculated checksum values instead of recalculating said checksum value -when said 
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computer file subject to a subsequent access without any intervening change having been 
made to said computer file. 

13. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a non-user specified database of data indicative 
of particular computer programs. 

14. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a user specified database of data indicative of 
particular computer programs. 

1 5. (original) A computer program product as claimed in claim 1 , wherein said 
computer virus scan request results from an on-access scan. 

16. (original) A computer program product as claimed in claim 1, wherein said 
computer virus scan request results from an on-demand scan. 

17. (original) A computer program product as claimed in claim 1 , wherein local 
audit data is stored upon a computer within a computer network until said computer is 
polled by a remote computer upon said computer network whereupon said local audit 
data is sent to said remote computer. 
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18, (original) A computer program product as claimed in claim 17, wherein said 
remote computer generates a consolidated audit report for a plurality of computers upon 
said computer network. 

19. (currently amended) A method of generating audit data indicative of a request 
to execute a computer program, said method comprising the steps of: 

(i) responsive to a computer virus scan request within a computer virus 
scanner, performing a computer virus scan and generating a scan result, said computer 
virus scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) triggering operation of an audit data genfer&tor which is separate from said 
computer virus scanner, u sing said computer virus scanner prior to said generating said scan 
result, said audit data generator being responsive to said data identifying said computer 
file to be scanne d that is received from said computer virus s canner for simultaneously 
performing additional operations in parallel with said computer virus scan, said additional 
operations including [[to ^identifying a request to execute a computer pit)grain associated 
with said computer file to be scanned for computer viruses bv said computer viru$ scanner ; 

(iii) in response to identification of said request to execute said computer 
program, generating audit data identifying said computer program; and 

(iv) performing a concurrent usage check for identifying a request to execute a 
further computer program that would result in said further computer program 
concurrently executing upon more than a predetermined number of computers upon a 
computer network; 

wherein said predetermined number varies with time. 
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20. (original) A method as claimed in claim 19, wherein a file access request to an 
operating system triggers generation of said computer virus scan request 

21. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to data identifying one or more banned computer programs to identify a 
request to execute a banned computer program. 

22. (original) A method as claimed in claim 21 , wherein, if a request to execute a 
banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

23. (original) A method as claimed in claim 21, wherein said data identifying one 
or more banned computer programs is a permitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer program. 

24. (cancelled) 
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25. (previously presented) A method as claimed in claim 19, wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
computer network concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 

26. (previously presented) A method as claimed in claim 25, wherein a user 
message is displayed when execution of said further computer program is prevented. 

27. (cancelled) 

28. (previously presented) A method as claimed in claim 19, wherein at certain 
times said predetermined number is zero. 

29. (original) A method as claimed in claim 19, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

30. (original) A method as claimed in claim 29, wherein said audit data generator 
stores said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 
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31. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to a non-usex specified database of data indicative of particular computer 
programs. 

32. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

33. (original) A method as claimed in claim 19, wherein said computer virus scan 
request results from an on-access scan. 

34. (original) A method as claimed in claim 19, wherein said computer virus scan 
request results from an on-demand scan. 

35. (original) A method as claimed in claim 19, wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

36. (original) A method as claimed in claim 35, wherein said remote computer 
generates a consolidated audit report for a plurality of computers upon said computer 
network. 
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37. (currently amended) Apparatus for generating audit data indicative of a 
request to execute a computer program, said apparatus comprising: 

(i) a computer virus seamier, responsive to a computer virus scan request, for 
performing a computer virus scan and for generating a scan result, said computer virus 
scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) an audit data generator separate from said computer virus scanner an d being 
triggered by said computer virus scanner [[logic ]] prior to said generating said scan result, 
and responsive to said data identifying said computer file to be scanned that js received 
from said computer virus scanner for simultane ously performing additional operations in 
parallel with said computer virus scan, said additional op erations including 

[[, for]] identifying a request to execute a computer pmpram associated with said computer 
file to be scanned for computer viruses bv said computer v irus scanner and, in response to 
identification of said request to execute said computer program»[[ for]] generating audit 
data identifying said computer program; and 

concurrent usage monitor for performing a concurrent usage check for identifying 
a request to execute a further computer program that would result in said further 
computer program concurrently executing upon more than a predetermined number of 
computers upon a computer network; 

wherein said predetermined number varies with time. 

38. (original) Apparatus as claimed in claim 37, wherein a file access request to 
an operating system triggers generation of said computer virus scan request, 
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39. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to data identifying one or more banned computer programs to identify a 
request to execute a banned computer program. 

40. (original) Apparatus as claimed in claim 39, wherein, if a request to execute a 
banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

41 . (original) Apparatus as claimed in claim 39, wherein said data identifying one 
or more banned computer programs is a permitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer program. 

42. (cancelled) 

43. (previously presented) Apparatus as claimed in claim 37, wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
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computer network concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 

44. (previously presented) Apparatus as claimed in claim 43, wherein a user 
message is displayed when execution of said further computer program is prevented. 

45. (cancelled) 

46. (previously presented) Apparatus as claimed in claim 37, wherein at certain 
times said predetermined number is zero. 

47. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

48. (original) Apparatus as claimed in claim 47, wherein said audit data generator 
stores said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 
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49. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs. 

50. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

5 1 . (original) Apparatus as claimed in claim 37 5 wherein said computer virus scan 
request results from an on-access scan. 

52. (original) Apparatus as claimed in claim 37, wherein said computer virus scan 
request results from an on-demand scan. 

53. (original) Apparatus as claimed in claim 37, wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer, 

54. (currently amended) Apparatus as claimed in claim 53, wherein said remote 
computer generates a consolidated audit report for a plurality of computers upon said 
computer network, [[.]] 
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55.-57. (cancelled) 

58. (new) A computer program product as claimed in claim 1, wherein said 
computer virus scanner logic generates said scan result after receiving a reply from said 
audit data generator logic. 

59. (new) A computer program product as claimed in claim 1, wherein said 
computer virus scanner logic generates said scan result as a function of a reply from said 
audit data generator logic. 

60. (new) A computer program product as claimed in claim 1 ? wherein a reply 
from said audit data generator logic is not used by said computer virus scanner logic if 
said scan result includes a failure. 

61 . (new) A computer program product as claimed in claim 1, wherein said data 
identifying said computer file is sent to said audit data generator logic priof to performing 
said computer virus scan. 
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